# Read Virtual Network flow counters as interval contributions

> Preserve flow state and direction when calculating traffic totals from continuation and end records.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:59+00:00
- Modified: 2026-09-10T00:55:36+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Preserve flow state and direction when calculating traffic totals from continuation and end records.

## Potentially affected

Parsers and reports consuming Azure Virtual Network flow logs.

## DSE recommendation

Test aggregation against a known flow sequence, retaining state and direction instead of treating the last record as a lifetime total.

## Article

## Source facts

For Continuing and End flow states, Virtual Network flow-log byte and packet values cover the interval since the previous tuple record. Microsoft calculates a conversation total by adding those contributions, rather than treating the final record as the entire conversation.

A Begin record has no statistics. Sent and received counters are separate, and byte counts include packet headers as well as payload. These distinctions matter when defining the report’s total. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview).

## Applicability

Review the parser’s flow identity, ordering, state handling, and direction labels. State whether the intended metric is one-way traffic, both directions, or application payload; do not silently treat those measurements as interchangeable.

## DSE recommendation

DSE recommends a small documented fixture containing Begin, Continuing, and End records. Specify the expected contribution from each record and how duplicate or missing input is handled. Keep incomplete sequences visible in the report rather than inventing counters for absent intervals. Preserve the raw record reference for each aggregate.

## Verification

Run the fixture through the actual ingestion and reporting path. Compare directional sums with the expected values, then repeat with a duplicated record, a missing continuation, and an empty Begin record. Confirm that the report distinguishes known totals from incomplete observations and does not equate wire bytes with payload size.

## Official references

[Microsoft Learn: Virtual Network Flow Logs](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview). Source retrieved September 9, 2026.

## Primary reference

- Name: Virtual Network Flow Logs - Azure Network Watcher | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Read Virtual Network flow counters as interval contributions,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.